Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,339 results · page 459 of 827
Dec 31, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56046 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.
- Product
- WPLMS
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56042 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.3
- What to do
- Update WPLMS to 1.9.9.5.3 or newer.
Dec 31, 2024VibeBP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56041 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.
- Product
- VibeBP
- What to do
- Update VibeBP to the newest version.
Dec 31, 2024VibeBP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56039 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.
- Product
- VibeBP
- What to do
- Update VibeBP to the newest version.
Dec 31, 2024Smart Shopify Product: Missing AuthorizationCVE-2024-56031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through <= 1.0.2.
- Product
- Smart Shopify Product
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Smart Shopify Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP-CRM System: Missing AuthorizationCVE-2024-55991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.2.9.1.
- Product
- WP-CRM System
- Affected
- up to 3.2.9.1
- What to do
- Affects up to 3.2.9.1. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WooCommerce Subscriptions: Missing AuthorizationCVE-2023-50850 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Woo WooCommerce Subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Subscriptions: from n/a before 5.8.0.
- Product
- WooCommerce Subscriptions
- Fixed in
- 5.8.0
- What to do
- Update WooCommerce Subscriptions to 5.8.0 or newer.
Dec 31, 2024WP Cleanfix: Missing AuthorizationCVE-2023-48775 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gfazioli WP Cleanfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cleanfix: from n/a through 5.6.2.
- Product
- WP Cleanfix
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update WP Cleanfix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WooCommerce PDF Vouchers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56265 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Reflected XSS.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.9
- What to do
- Update WooCommerce PDF Vouchers to 4.9.9 or newer.
Dec 31, 2024Embed PDF Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56256 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer.This issue affects Embed PDF Viewer: from n/a through <= 2.3.1.
- Product
- Embed PDF Viewer
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Coupon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicky Kumar Coupon coupon-lite allows DOM-Based XSS.This issue affects Coupon: from n/a through <= 1.2.2.
- Product
- Coupon
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024VW Automobile Lite: Missing AuthorizationCVE-2024-56234 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through <= 2.1.
- Product
- VW Automobile Lite
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update VW Automobile Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024KinTPV WooConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinhelios KinTPV WooConnect kintpv-connect allows Stored XSS.This issue affects KinTPV WooConnect: from n/a through <= 8.129.
- Product
- KinTPV WooConnect
- Affected
- up to 8.129
- What to do
- Affects up to 8.129. Update KinTPV WooConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SaasPricing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio SaasPricing saaspricing allows DOM-Based XSS.This issue affects SaasPricing: from n/a through <= 1.2.4.
- Product
- SaasPricing
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update SaasPricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56228 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through <= 3.1.2.
- Product
- Wishlist for WooCommerce
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Royal Elementor Addons: Missing AuthorizationCVE-2024-56227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.
- Product
- Royal Elementor Addons
- Affected
- up to 1.7.1001
- What to do
- Affects up to 1.7.1001. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56226 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Reflected XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1001.
- Product
- Royal Elementor Addons
- Affected
- up to 1.7.1001
- What to do
- Affects up to 1.7.1001. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Premium Addons for Elementor: Missing AuthorizationCVE-2024-56225 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.56.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.10.56
- What to do
- Affects up to 4.10.56. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Ledenbeheer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56224 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ledenbeheer Ledenbeheer ledenbeheer-external-connection allows Stored XSS.This issue affects Ledenbeheer: from n/a through <= 2.1.0.
- Product
- Ledenbeheer
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Ledenbeheer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Gulri Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56223 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Gulri Slider gulri-slider allows Reflected XSS.This issue affects Gulri Slider: from n/a through <= 3.5.8.
- Product
- Gulri Slider
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update Gulri Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPMozo Addons Lite for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56221 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows Stored XSS.This issue affects WPMozo Addons Lite for Elementor: from n/a through <= 1.2.0.
- Product
- WPMozo Addons Lite for Elementor
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WPMozo Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Widget Options: Missing AuthorizationCVE-2024-56219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.6.1.
- Product
- Widget Options
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Download Manager: Missing AuthorizationCVE-2024-56217 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03.
- Product
- Download Manager
- Affected
- up to 3.3.03
- What to do
- Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Member Directory and Contact Form: Missing AuthorizationCVE-2024-56215 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Member Directory and Contact Form: from n/a through <= 1.7.0.
- Product
- Member Directory and Contact Form
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Member Directory and Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Userpro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56210 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Userpro userpro allows Reflected XSS.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Kleo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56209 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue affects Kleo: from n/a through < 5.4.4.
- Product
- Kleo
- What to do
- Update Kleo to the newest version.
Dec 31, 2024WP Nice Loader: Cross-Site Request Forgery (CSRF)CVE-2024-56232 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a through <= 0.1.0.4.
- Product
- WP Nice Loader
- Affected
- up to 0.1.0.4
- What to do
- Affects up to 0.1.0.4. Update WP Nice Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Dynamic Product Category Grid, Slider for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56230 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Dynamic Product Category Grid, Slider for WooCommerce dynamic-product-categories-design allows PHP Local File Inclusion.This issue affects Dynamic Product Category Grid, Slider for WooCommerce: from n/a through <= 1.1.3.
- Product
- Dynamic Product Category Grid, Slider for WooCommerce
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Dynamic Product Category Grid, Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SearchIQ: Cross-Site Request Forgery (CSRF)CVE-2024-56229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SearchIQ SearchIQ searchiq.This issue affects SearchIQ: from n/a through <= 4.6.
- Product
- SearchIQ
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024CodeBard Help Desk: Cross-Site Request Forgery (CSRF)CVE-2024-56222 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Cross Site Request Forgery.This issue affects CodeBard Help Desk: from n/a through <= 1.1.1.
- Product
- CodeBard Help Desk
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SSL Wireless SMS Notification: Incorrect Privilege AssignmentCVE-2024-56220 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.
- Product
- SSL Wireless SMS Notification
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Contact Form 7 – Dynamic Text Extension: Cross-Site Request Forgery (CSRF)CVE-2024-56218 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site Request Forgery.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through <= 5.0.1.
- Product
- Contact Form 7 – Dynamic Text Extension
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update Contact Form 7 – Dynamic Text Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Themify Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56216 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through <= 7.6.3.
- Product
- Themify Builder
- Affected
- up to 7.6.3
- What to do
- Affects up to 7.6.3. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Userpro: Path Traversal: '.../...//'CVE-2024-56214 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Eventin: Path Traversal: '.../...//'CVE-2024-56213 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.
- Product
- Eventin
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Userpro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56212 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Userpro: Missing AuthorizationCVE-2024-56211 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 29, 2024The Ninja Forms – The Contact Form Builder That Grows With You: Arbitrary shortcode executionCVE-2024-12238 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.8.22
- What to do
- Affects up to 3.8.22. Update The Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 27, 2024GiveWP: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-11921 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- GiveWP
- Fixed in
- 3.19.0
- What to do
- Update GiveWP to 3.19.0 or newer.
Dec 27, 2024DN Shipping by Weight for WooCommerce: Does not have CSRF check in placeCVE-2024-11842 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Shipping by Weight for WooCommerce
- Fixed in
- 1.2
- What to do
- Update DN Shipping by Weight for WooCommerce to 1.2 or newer.
Dec 27, 2024float block: Does not sanitise and escape some of its settingsCVE-2024-11645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- float block
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update float block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024WP-SVG: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11644 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP-SVG
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update WP-SVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024wp-publications: Does not escape filenames before outputting them back in the pageCVE-2024-11605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- wp-publications
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update wp-publications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-11223 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPForms
- Fixed in
- 1.9.2.3
- What to do
- Update WPForms to 1.9.2.3 or newer.
Dec 26, 2024Broken Link Checker: Does not validate a the link URLs before making a request to themCVE-2024-10903 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
- Product
- Broken Link Checker
- Fixed in
- 2.4.2
- What to do
- Update Broken Link Checker to 2.4.2 or newer.
Dec 25, 2024Avada (Fusion) Builder: Information ExposureCVE-2024-12335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- Avada (Fusion) Builder
- Affected
- up to 3.11.12
- What to do
- Affects up to 3.11.12. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordavada.comwordfence.com
Dec 25, 2024WooCommerce Point of Sale: Privilege escalationCVE-2024-11281 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attackers to change the email of arbitrary user accounts. This makes it possible for unauthenticated attackers to change the email of arbitrary user accounts, including administrators, and reset their password to gain access to the account.
- Product
- WooCommerce Point of Sale
- Affected
- up to 6.1.0
- What to do
- Affects up to 6.1.0. Update WooCommerce Point of Sale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Dec 25, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: SQL InjectionCVE-2024-10862 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_params' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited via CSRF due to a lack of nonce validation on the get_table_records AJAX action.
- Product
- NEX-Forms – Ultimate Form Builder – Contact forms and much more
- Affected
- up to 8.7.15
- What to do
- Affects up to 8.7.15. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 25, 2024Jetpack: Does not properly checks the postmessage origin in its 13CVE-2024-10858 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
- Product
- Jetpack
- Fixed in
- 14.1
- What to do
- Update Jetpack to 14.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.